linux-kernel - Re: [PATCH v2] iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250114175403.GO26854@ziepe.ca>
Date: Tue, 14 Jan 2025 13:54:03 -0400
From: Jason Gunthorpe <jgg@...pe.ca>
To: Qasim Ijaz <qasdev00@...il.com>
Cc: kevin.tian@...el.com, joro@...tes.org, will@...nel.org,
	robin.murphy@....com, iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	syzbot <syzbot+85992ace37d5b7b51635@...kaller.appspotmail.com>
Subject: Re: [PATCH v2] iommufd/iova_bitmap: Fix shift-out-of-bounds in
 iova_bitmap_offset_to_index()

On Mon, Jan 13, 2025 at 10:38:20PM +0000, Qasim Ijaz wrote:
> Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where
> shifting the constant "1" (of type int) by bitmap->mapped.pgshift 
> (an unsigned long value) could result in undefined behavior. 
> 
> The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63)
> the shift operation overflows, as the result cannot be represented in a 32-bit type.
> 
> To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type 
> to match the operand's type.
> 
> Reported-by: syzbot <syzbot+85992ace37d5b7b51635@...kaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
> Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
> Signed-off-by: Qasim Ijaz <qasdev00@...il.com>
> ---
>  drivers/iommu/iommufd/iova_bitmap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied to iommufd for-next

Thanks,
Jason